A time‑of‑check to time‑of‑use race condition in the AMD SEV Secure Encrypted Virtualization firmware allows an attacker with administrative privileges to bypass security checks on scatter lists, potentially compromising the integrity of the guest operating system.

The flaw affects the AMD SEV firmware used with AMD EPYC 9005 Series Processors and AMD EPYC Embedded 9005 Series Processors in virtualized environments. Specific affected firmware versions were not listed, so the issue likely applies to all currently available releases of AMD SEV.

The CVSS score of 4 indicates a low severity flaw. EPSS score is <1%, and the vulnerability is not listed in the CISA KEV catalog. The attack requires administrative privileges on the host or hypervisor; an attacker with such access could exploit the timing race to alter scatter list handling and compromise guest integrity.